Analysis
-
max time kernel
110s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 18:37
Static task
static1
Behavioral task
behavioral1
Sample
722745a1b594b935445310f8b4f0b9af.exe
Resource
win7-en-20211014
General
-
Target
722745a1b594b935445310f8b4f0b9af.exe
-
Size
537KB
-
MD5
722745a1b594b935445310f8b4f0b9af
-
SHA1
2945a2c49a0f0978560b5272ce9ddfbf44855fc8
-
SHA256
dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e
-
SHA512
f571211c33c3739cbe26ae6b694d62aebf86a169f8f22f01a19c802323ad8ce143b1c7f0d8f062d478ad976ef5277ae485619c95711c852455abef8de436e35e
Malware Config
Extracted
nanocore
1.2.2.0
drrkingsleym001.ddns.net:1665
70bb352e-dceb-4105-9fdd-010e83e28b1b
-
activate_away_mode
true
-
backup_connection_host
drrkingsleym001.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-31T04:41:53.700956836Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
NEW LIFE
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
70bb352e-dceb-4105-9fdd-010e83e28b1b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
drrkingsleym001.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
722745a1b594b935445310f8b4f0b9af.exedescription pid process target process PID 3044 set thread context of 2228 3044 722745a1b594b935445310f8b4f0b9af.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Program Files (x86)\SCSI Service\scsisvc.exe RegSvcs.exe File created C:\Program Files (x86)\SCSI Service\scsisvc.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4032 schtasks.exe 496 schtasks.exe 1016 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
722745a1b594b935445310f8b4f0b9af.exeRegSvcs.exepid process 3044 722745a1b594b935445310f8b4f0b9af.exe 3044 722745a1b594b935445310f8b4f0b9af.exe 2228 RegSvcs.exe 2228 RegSvcs.exe 2228 RegSvcs.exe 2228 RegSvcs.exe 2228 RegSvcs.exe 2228 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2228 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
722745a1b594b935445310f8b4f0b9af.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3044 722745a1b594b935445310f8b4f0b9af.exe Token: SeDebugPrivilege 2228 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
722745a1b594b935445310f8b4f0b9af.exeRegSvcs.exedescription pid process target process PID 3044 wrote to memory of 4032 3044 722745a1b594b935445310f8b4f0b9af.exe schtasks.exe PID 3044 wrote to memory of 4032 3044 722745a1b594b935445310f8b4f0b9af.exe schtasks.exe PID 3044 wrote to memory of 4032 3044 722745a1b594b935445310f8b4f0b9af.exe schtasks.exe PID 3044 wrote to memory of 2228 3044 722745a1b594b935445310f8b4f0b9af.exe RegSvcs.exe PID 3044 wrote to memory of 2228 3044 722745a1b594b935445310f8b4f0b9af.exe RegSvcs.exe PID 3044 wrote to memory of 2228 3044 722745a1b594b935445310f8b4f0b9af.exe RegSvcs.exe PID 3044 wrote to memory of 2228 3044 722745a1b594b935445310f8b4f0b9af.exe RegSvcs.exe PID 3044 wrote to memory of 2228 3044 722745a1b594b935445310f8b4f0b9af.exe RegSvcs.exe PID 3044 wrote to memory of 2228 3044 722745a1b594b935445310f8b4f0b9af.exe RegSvcs.exe PID 3044 wrote to memory of 2228 3044 722745a1b594b935445310f8b4f0b9af.exe RegSvcs.exe PID 3044 wrote to memory of 2228 3044 722745a1b594b935445310f8b4f0b9af.exe RegSvcs.exe PID 2228 wrote to memory of 496 2228 RegSvcs.exe schtasks.exe PID 2228 wrote to memory of 496 2228 RegSvcs.exe schtasks.exe PID 2228 wrote to memory of 496 2228 RegSvcs.exe schtasks.exe PID 2228 wrote to memory of 1016 2228 RegSvcs.exe schtasks.exe PID 2228 wrote to memory of 1016 2228 RegSvcs.exe schtasks.exe PID 2228 wrote to memory of 1016 2228 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\722745a1b594b935445310f8b4f0b9af.exe"C:\Users\Admin\AppData\Local\Temp\722745a1b594b935445310f8b4f0b9af.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iGlXinw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9EF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD0C.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD8A.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD0C.tmpMD5
40b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmpD8A.tmpMD5
4e71faa3a77029484cfaba423d96618f
SHA19c837d050bb43d69dc608af809c292e13bca4718
SHA256c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb
SHA5126d014de41352f2b0b494d94cd58188791e81d4e53578d0722110b6827793b735e19c614877f25c61b26233dea1b5f1998ba1240bdc8fa04c87b7e64a4ca15fe0
-
memory/496-119-0x0000000000000000-mapping.dmp
-
memory/1016-122-0x0000000000000000-mapping.dmp
-
memory/2228-117-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2228-118-0x000000000041E792-mapping.dmp
-
memory/2228-121-0x0000000002CB0000-0x0000000002CB1000-memory.dmpFilesize
4KB
-
memory/2228-124-0x0000000002CB1000-0x0000000002CB2000-memory.dmpFilesize
4KB
-
memory/3044-115-0x0000000000EE0000-0x0000000000EE1000-memory.dmpFilesize
4KB
-
memory/4032-116-0x0000000000000000-mapping.dmp